Resubmissions

05/02/2024, 05:43

240205-gez5tsdhbq 10

27/11/2023, 04:47

231127-fel3jaec4x 10

General

  • Target

    02c6afc6297dce33b1a7b9db1be1002387d0744222471657c224b763b06e03c0

  • Size

    14.8MB

  • Sample

    240205-gez5tsdhbq

  • MD5

    11c31a8b40db0bac16f603ca47e5b0cf

  • SHA1

    f1160754ef8dea27aae887e426bd3b5c0f90722e

  • SHA256

    02c6afc6297dce33b1a7b9db1be1002387d0744222471657c224b763b06e03c0

  • SHA512

    cfaf78e625d5ed6254d3fb45bd786a937eea9b95645f58bfd37904bfe4991e2599de82266583ce7b367abd20cf87b1b52166918e02264bd5bae0d337d4fa6a7a

  • SSDEEP

    393216:rexbl6e6TvVmR/i+W7F/+8HVi5vcPF07zvrRl:rexZp0mRa+W7F/p1i5KF0PrR

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      02c6afc6297dce33b1a7b9db1be1002387d0744222471657c224b763b06e03c0

    • Size

      14.8MB

    • MD5

      11c31a8b40db0bac16f603ca47e5b0cf

    • SHA1

      f1160754ef8dea27aae887e426bd3b5c0f90722e

    • SHA256

      02c6afc6297dce33b1a7b9db1be1002387d0744222471657c224b763b06e03c0

    • SHA512

      cfaf78e625d5ed6254d3fb45bd786a937eea9b95645f58bfd37904bfe4991e2599de82266583ce7b367abd20cf87b1b52166918e02264bd5bae0d337d4fa6a7a

    • SSDEEP

      393216:rexbl6e6TvVmR/i+W7F/+8HVi5vcPF07zvrRl:rexZp0mRa+W7F/p1i5KF0PrR

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • UAC bypass

    • Windows security bypass

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks